On this page

Atomicorp WAF Rule 300112

Rule Summary

  • Rule ID: 300112
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: HTTP Smuggling Attack: Multiple Transfer-Encoding headers detected
  • Observed CWEs: None documented
  • Revision: 1
  • Rule severity: Critical
  • Phase: 2 (request body)
  • Request surfaces: Request headers
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule detects if two or more Transfer-Encoding headers are set on a request. There is no legitimate traffic that uses this method, this is an attack.

False Positives

There are no known False Positives for this.

If you believe this is a false positive, it is recommended that you report this to our security team can determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page.

Similar Rules

WAF_300113

WAF_300114

WAF_300111

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 300112
  • Source revision: 6926
  • Source revision date: 2024-08-01